docs: name authelia's disabled flag in the placeholder-user wording, and update the comment that cites the renamed subagent heading

docs/getting-started/setup.md

@@ -57,7 +57,7 @@ What the granter is, why it's root-equivalent, and the store's TLS:
 ## 2 · Your SSO account
 
 _On the host running authelia._ Until this runs, `auth.<swarm.domain>` serves
-a login page that refuses everyone: its only subject is an inactive placeholder.
+a login page that refuses everyone: its only subject is a placeholder marked `disabled`.
 
 ```bash
 swarmctl user add mara --display-name Mara --email mara@example.com --group admins

docs/networking/gateway.md

@@ -42,7 +42,7 @@ The catch-all `_` vhost answers any other `Host` with `444` (connection closed,
 
 Only the host that **runs** authelia declares `auth.<swarm>`; a hive that merely uses SSO knows `swarm.authelia.url` but doesn't answer for that name. The server name must be exactly `swarm.authelia.domain` — authelia checks that `authelia_url` sits inside its session cookie domain at startup, and refuses to boot otherwise. The vhost carries no `auth_request` (that would put the login page behind the login it serves) and passes `X-Forwarded-{Proto,Host,Uri,For}`, because authelia decides by the original request.
 
-⚠️ `auth.<swarm>` answering with the **sso unavailable** page means authelia isn't answering at all — check `journalctl -M swarm-authelia -u authelia-swarm`. While the user set is empty, an inactive placeholder user keeps authelia's user store non-empty, so it boots fine and serves a login page that refuses everyone; add the first account with `swarmctl user add …` ([`setup.md`](../getting-started/setup.md)).
+⚠️ `auth.<swarm>` answering with the **sso unavailable** page means authelia isn't answering at all — check `journalctl -M swarm-authelia -u authelia-swarm`. While the user set is empty, a placeholder user marked `disabled` keeps authelia's user store non-empty, so it boots fine and serves a login page that refuses everyone; add the first account with `swarmctl user add …` ([`setup.md`](../getting-started/setup.md)).
 
 Per-agent UIs stay sub-path; forge and matrix get sub-domains → [Sub-domain shape](#sub-domain-shape-rationale).
 

docs/swarm/services.md

@@ -128,7 +128,7 @@ publishes it as
 It answers only swarm-controller's OIDC client
 (`swarm.controller.queueClientId`) and refuses every other token `403`.
 
-On first boot this module seeds the users database with an inactive placeholder subject, so authelia has a non-empty store to start against before any real account exists (`swarm-authelia.nix:873`). Authelia generates session and storage keys in the container on
+On first boot this module seeds the users database with a placeholder subject marked `disabled`, so authelia has a non-empty store to start against before any real account exists (`swarm-authelia.nix:873`). Authelia generates session and storage keys in the container on
 first boot and never rotates them automatically; replacing one
 invalidates data already written (sessions, the encrypted store), so
 that's an operator action.

hive-subagent-mcp/src/session.rs

@@ -2323,7 +2323,7 @@ pub fn status(state: &State, name: &str, dir: Option<&str>) -> anyhow::Result<St
 /// Deliberately just the number now — the full "seconds means working,
 /// minutes means wedged, resets each turn" explanation used to repeat here
 /// on every single call. It already lives in the `status` tool description
-/// and in `docs/tools/subagent.md`'s "Is it working, or is it wedged?"
+/// and in `docs/tools/subagent.md`'s "Telling working from wedged"
 /// section, so restating it in a line meant to be skimmed, possibly several
 /// times a minute, was pure repetition.
 ///